I've been deep in the weeds evaluating JIT (Just-in-Time) PAM solutions for our AWS environments, specifically for breaking glass into prod accounts and temporary elevation for CI/CD pipelines. Two names keep coming up: Entro Security and Token Security.
My core requirement is Terraform-native integration. I need to manage elevations, policies, and integrations via IaC, not a GUI. I'm also looking at:
* Cost transparency (tying elevations to specific projects/teams)
* Slack/Microsoft Teams approval workflows
* Clean audit trails that feed into our existing SIEM
From my initial probing:
* **Entro** seems strong on the secrets discovery and posture side, but their PAM/JIT workflows feel a bit more "baked-in" and less customizable via API/Terraform.
* **Token** appears built from the ground up for programmatic, automated access. Their focus on temporary credentials for AWS IAM Roles, Kubernetes `kubeconfig`, and database access seems to align with my infrastructure-as-everything mindset.
Has anyone implemented either in a heavily automated environment? I'm particularly interested in how you've codified the policies. Something like this pseudo-Terraform is what I'm aiming for:
```hcl
# Example of what I'd like to define in code
module "jit_break_glass" {
source = "git:: https://.../token-terraform-module s"
role_arn = aws_iam_role.admin.arn
max_duration = "1h"
approval_channel = "#security-emergency"
eligible_users = var.sre_team_ids
require_mfa = true
}
```
The big question: which platform's underlying model lends itself better to this kind of codified, GitOps-style approach? Are there hidden pitfalls in the API design of one versus the other when you try to manage everything as code?